Flash loan attack

A flash loan is a legitimate decentralized finance mechanism allowing the borrowing of an arbitrarily large sum of liquidity, without collateral, provided it is repaid within the same atomic on-chain transaction. If repayment does not occur, the entire transaction is canceled as if it never happened. Designed for arbitrage or instant refinancing purposes, this mechanism was quickly hijacked by attackers who use it to transiently acquire considerable economic power, manipulate the price oracles that value a protocol's assets, and exploit the resulting price distortion to drain the protocol's liquidity, all within a fraction of a second. The first large-scale attack targeted bZx in February 2020, draining 350,000 dollars in two consecutive transactions; since then, similar attacks have caused losses of several hundred million dollars on major protocols. The legal and insurance peculiarity of flash loan attacks is troubling: the attacker never possessed their own capital, all their actions are mathematically reversible if the transaction fails, and the vulnerability exploited is often in the protocol design rather than in malicious code in the classical sense. DeFi sector insurers struggle to qualify these losses: are they a smart-contract bug, market manipulation or exploitation of a deliberately available feature? The answer determines coverage.

In October 2021, the Cream Finance protocol suffers a 130-million-dollar flash loan attack. The attacker borrows 500 million DAI, manipulates the price of an illiquid collateral token that Cream uses to calculate its value, and borrows more than the real collateral would normally allow. The entire transaction executes in one Ethereum block, approximately twelve seconds. No existing DeFi insurance covers the full loss.

flash loan attack, prêt flash, flash loan, attaque DeFi, attaque par emprunt instantané